Risk Level 1: Very Low

February 13, 2007 12:11:15 PM
Also Known As:

The XM.Sofa virus is the first member of the second family of Excel macro viruses. First discovered by SARC in early December of 1996 (west coast USA), XM.Sofa, like other Excel macro viruses, is written in MS Visual Basic and it spreads by copying its own viral macros to other MS Excel spreadsheet hosts. Unlike XM.Laroux (the first known, viable Excel macro virus) which infects by creating a file called PERSONAL.XLS in the default startup directory, XM.Sofa spreads by way of a file called BOOK.XLT placed in the alternate startup directory.

Antivirus Protection Dates

  • Initial Rapid Release version December 19, 2000
  • Latest Rapid Release version December 19, 2000
  • Initial Daily Certified version December 19, 2000
  • Latest Daily Certified version December 19, 2000
  • Initial Weekly Certified release date pending
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment


  • Wild Level: Low
  • Number of Infections: 0 - 49
  • Number of Sites: 0 - 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Easy


  • Damage Level: Low


  • Distribution Level: Low
Note: On May 14, 2015, modifications will be made to the threat write-ups to streamline the content. The Threat Assessment section will no longer be published as this section is no longer relevant to today's threat landscape. The Risk Level will continue to be the main threat risk assessment indicator.

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report